PAP-10287 tighten teams catalog review finish

Co-Authored-By: Paperclip <noreply@paperclip.ing>

packages/shared/src/validators/teams-catalog.ts

@@ -136,7 +136,7 @@ export const catalogTeamSourcePolicySchema = z.object({
 export const catalogTeamPreviewSchema = z.object({
   targetManagerAgentId: z.string().min(1).nullable().optional(),
   targetManagerSlug: z.string().min(1).nullable().optional(),
-  include: portabilityIncludeSchema.optional(),
+  include: portabilityIncludeSchema.omit({ company: true }).strict().optional(),
   agents: portabilityAgentSelectionSchema.optional(),
   collisionStrategy: portabilityCollisionStrategySchema.optional(),
   nameOverrides: z.record(z.string().min(1), z.string().min(1)).optional(),

server/src/__tests__/teams-catalog-routes.test.ts

@@ -244,6 +244,25 @@ describe("teams catalog routes", () => {
     );
   });
 
+  it("rejects catalog preview requests that try to include company metadata", async () => {
+    const app = await createApp({
+      type: "board",
+      userId: "local-board",
+      companyIds: [companyId],
+      source: "local_implicit",
+      isInstanceAdmin: false,
+    });
+
+    const res = await request(app)
+      .post(`/api/companies/${companyId}/teams/catalog/product-engineering/preview`)
+      .send({
+        include: { company: true, agents: true },
+      });
+
+    expect(res.status, JSON.stringify(res.body)).toBe(400);
+    expect(mockTeamsCatalogService.previewCatalogTeamImport).not.toHaveBeenCalled();
+  });
+
   it("installs catalog teams only for actors that can create agents", async () => {
     const app = await createApp({
       type: "agent",